Deck 9: Coding in the Cube: Developing Good Habit

Question 1

Application errors expose a lot of information about the code and its environment.

Answer 1

True

Question 2

There is only one type of error in application development: compile-time errors.

Answer 2

False

Question 3

An exception handler can only be created to log error messages for developers.

Answer 3

False

Question 4

PHP is the most popular server-side language in Web development and continues to evolve as the market leader in application security.

Question 5

What you choose to tell the user in error messages is up to you, but it should specifically benefit them.

Question 6

You do not have to cancel a user's ID or password if they exceed a specified threshold of login times.

Question 7

Logging user traffic, events and data flow is one of the best analysis techniques you can do for an application.

Question 8

When logging tailored messages for an application, use a file separate from the server logs and secure the priveleges on that file.

Question 9

Input cleansing is an optional task for securing the application.

Question 10

Code refactoring occurs when existing bodies of logic are broken up and moved into many smaller bodies of code.

Question 11

Data authorization is a two-way street: first, the user's ID must be validated and second the user's request needs to be authorized.

Question 12

PHP is a server-side language that runs on application servers.

Question 13

Spaghetti code is rather inexpensive to maintain.

Question 14

Not every request that comes into the application should be treated as a potential attack.

Question 15

Some popular programming languages that deal wth security include the following: -Java -PHP -C/C++

Question 16

Open source code is greatly discouraged within the software community.

Question 17

Data encapsulation hides all internal code, variables, and logic from the outside world, therefore restricting acces to any outside callers.

Question 18

Exception handling is the cornerstone for all secure code.

Question 19

The most notable security flaw with the C/C++ language is the buffer overflow attack.

Question 20

Use singleton objects when a common object or task will be used across multiple use cases for the same reason.

Question 21

Where should the variables that a program uses be defined?

A) At the end of a program
B) In the middle of a program
C) At the top of the program
D) When the code needs it

Question 22

A method's signature is an example of limited code.

Question 23

Parameter-driven software is software that looks up values stored in a database and determines what to display, allow, or execute based on those values.

Question 24

After the debug methods are built into the program, they can be called anywhere at anytime within the program you need to test.

Question 25

How can an application alert stakeholders of invasion?

A) cancel the user's password
B) send out SMS messages
C) log the activity in a log file
D) catch all errors

Question 26

Which program language is vulnerable to a buffer overflow attack?

A) JAVA
B) C++
C) PHP
D) Perl

Question 27

What is it called when developers write a piece of software for a specific purpose

A) software diversity
B) code unit
C) parameter-driven code
D) limited code

Question 28

What is it called when existing bodies of logic are broken up and moved into many smaller bodies of code?

A) reusable code
B) refactor code
C) code review
D) code debugging

Question 29

It is best to wait to add debugging techniques to the code when the code is broken.

Question 30

Which item is NOT a characteristic of self-monitoring code?

A) Canceling user passwords
B) Requiring physical requests for data
C) Code refactoring
D) Alerting stakeholders of invasion

Question 31

When reusable code gets buried into other code, the logic can and should be reused by other use cases.

Question 32

How should a developer code for DEBUGS?

A) Add the DEBUG statements in when needed
B) Build the debug logic into the code while developing
C) Use a debug editor
D) Use a peer review process

Question 33

What type of software looks up values stored in a database and determines what to display, allow, or execute based on those values

A) limited code
B) software diversity
C) parameter-driven
D) debugging

Question 34

If logic bombs or Trojan horses were to be snuck in, what type of file would the easiest target?

A) JAR files
B) Java files
C) SQL scripts
D) ANT scripts

Question 35

What design pattern forces the server to create only one object in its heap, thus making the server run very efficiently while using minimum RAM?

A) MVC
B) Template
C) Singleton
D) Abstract

Question 36

What is the best way to turn off DEBUG statements in the code?

A) automate a script
B) look at the code and manually turn them off
C) leave them on since the information only goes to a log file
D) Use the IDE to turn them off

Question 37

What is it called when software is developed on the premise that specifications, data, and environments will change?

A) software diversity
B) limited code
C) parameter-driven code
D) debugging code

Question 38

If requesting the application to provide sensitive information over the public network can sometimes be too risky, what should be done?

A) Take the chance and send the data
B) Log all activity
C) Send it but encrypt the data
D) Requiring Physical Requests for Data

Question 39

Which option is NOT a characteristics of Organized code?

A) Import only the classes that are needed to run the program
B) Avoid spaghetti code
C) Declare variables he program uses at the top
D) Use an IDE

Question 40

What should the application do if the user has failed to log in after 5 attempts?

A) allow the user to keep trying
B) cancel the user and force them to request a new id
C) cancel the user for 24 hours
D) cancel the user's password

Question 41

What type of errors are found in syntax?

A) Run time errors
B) Compile time errors
C) SQL errors
D) User errors

Question 42

What type of list defines only accepted input values?

A) Good list
B) Black list
C) White list
D) Validation list

Question 43

Which is NOT a characteristic of validation the input request?

A) Cleansing the request
B) Authorizing the sender
C) Code for software diversity
D) Encapsulating the data

Question 44

Which statement best suits the generalization of error messages?

A) More is best
B) error messages the users see, however, should not be the error messages the developers see
C) Everyone needs to see the Error messages
D) Error messages help to the developers fix problems.

Question 45

What is the grouping and storing of data inside a single object?

A) Encapsulation
B) Encryption
C) Code hiding
D) Code diversity

Question 46

What is the best way to handle program errors?

A) Place the code between try{} catch {} blocks and handle each error as they occur.
B) Handle each error by adding DEBUG statements
C) Log all Errors in the log file
D) The program should shut down securely of each error

Question 47

Which of the following steps are NOT needed to for exception handling?

A) Code your own routine
B) Create application-specific exceptions
C) Add debug statements
D) Manage the views

Question 48

Where do most attacks to software come from?

A) Back door
B) Input fields
C) Servers
D) Database

Question 49

What type of list defines bad input values?

A) Bad list
B) Black list
C) White list
D) No Valid list

Question 50

What type of errors when a data flow does not flow as expected?

A) Compile time
B) User errors
C) Run time
D) SQL errors